Malicious Link
Sub-technique of AML.T0011 User Execution
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.
There are many ways an adversary can leverage malicious links to gain access to a victim system via an AI system. For example, an AI Agent that is configured to not validate website origin headers will accept connections from any website, allowing adversaries to access otherwise inaccessible networks.
- ATLAS ID
- AML.T0011.003
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Enterprise
Mitigations
ATLAS 2026.09 lists no mitigation for this technique; see the parent technique.
Case studies that use it
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-IAAIdentifier Activity Analysis1 shared
- D3-UAURL Analysis1 shared
- D3-URAURL Reputation Analysis1 shared
- D3-HDHomoglyph Detection1 shared
- D3-OTFOutbound Traffic Filtering1 shared
- D3-RPARelay Pattern Analysis1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.